ADS usage is pretty easy, for instance: the command“type myrootkit.exe > c:\windows\system32\notepad.exe:myrootkit.exe”will fork the common windows Notepad program with an ADS “myrootkit.exe.”

Once injected, the ADS can be executed by using traditional commands like type, or start or be scripted inside typical scripting languages like VB or Perl, for example:"start c:\windows\system32\notepad.exe:myrootkit.exe” will launch myrootkit.exe but the process shown on taskmanager is notepad.exe